I have an installation of ossec server and agents within one physical server in different jails. Agents correctly report what they need right after start but after about one hour of running I see this in their agent logs:
2009/06/11 20:45:27 ossec-execd: INFO: Started (pid: 82403). 2009/06/11 20:45:27 ossec-agentd(1410): INFO: Reading authentication keys file. 2009/06/11 20:45:27 ossec-agentd: INFO: Started (pid: 82407). 2009/06/11 20:45:27 ossec-agentd: INFO: Server IP Address: x.x.x.x 2009/06/11 20:45:27 ossec-agentd: INFO: Trying to connect to server (x.x.x.x:1514). 2009/06/11 20:45:28 ossec-agentd(4102): INFO: Connected to the server (x.x.x.x:1514). 2009/06/11 20:45:33 ossec-logcollector(1950): INFO: Analyzing file: '/ var/log/messages.log'. 2009/06/11 20:45:33 ossec-logcollector: INFO: Started (pid: 82411). 2009/06/11 20:45:33 ossec-syscheckd: INFO: Started (pid: 82415). 2009/06/11 20:45:33 ossec-rootcheck: INFO: Started (pid: 82415). 2009/06/11 21:13:11 ossec-syscheckd: INFO: Starting syscheck scan (db). 2009/06/11 22:19:14 ossec-syscheckd: INFO: Ending syscheck scan (db). 2009/06/11 22:19:54 ossec-rootcheck: INFO: Starting rootcheck scan. 2009/06/11 22:21:06 ossec-logcollector: socket busy .. 2009/06/11 22:21:06 ossec-agentd: INFO: Event count after '20000': 3558146->2924792 (82%) 2009/06/11 22:21:16 ossec-logcollector: socket busy .. 2009/06/11 22:22:00 ossec-logcollector: socketerr (not available). 2009/06/11 22:22:00 ossec-logcollector(1224): ERROR: Error sending message to queue. 2009/06/11 22:23:35 ossec-logcollector: socket busy .. 2009/06/11 22:25:18 ossec-agentd: INFO: Event count after '20000': 2400644->2241456 (93%) 2009/06/11 22:25:55 ossec-logcollector: socket busy .. 2009/06/11 22:26:05 ossec-logcollector: socket busy .. 2009/06/11 22:26:07 ossec-logcollector: socketerr (not available). 2009/06/11 22:26:07 ossec-logcollector(1224): ERROR: Error sending message to queue. 2009/06/11 22:27:52 ossec-logcollector: socket busy .. 2009/06/11 22:28:02 ossec-logcollector: socket busy .. and there is nothing special in ossec server logs: 2009/06/11 20:44:14 ossec-analysisd: INFO: Started (pid: 81792). 2009/06/11 20:44:14 ossec-remoted(4111): INFO: Maximum number of agents allowed: '256'. 2009/06/11 20:44:14 ossec-remoted(1410): INFO: Reading authentication keys file. 2009/06/11 20:44:14 ossec-remoted: INFO: Assigning counter for agent 1: '19820:9256'. 2009/06/11 20:44:14 ossec-remoted: INFO: Assigning counter for agent 2: '13404:7305'. 2009/06/11 20:44:14 ossec-remoted: INFO: Assigning counter for agent 3: '11650:1972'. 2009/06/11 20:44:14 ossec-remoted: INFO: Assigning sender counter: 1:9157 2009/06/11 20:44:15 ossec-monitord: INFO: Started (pid: 81809). 2009/06/11 20:44:17 ossec-analysisd: INFO: Connected to '/queue/alerts/ ar' (active-response queue) 2009/06/11 20:44:17 ossec-analysisd: INFO: Connected to '/queue/alerts/ execq' (exec queue) 2009/06/11 20:44:20 ossec-logcollector(1950): INFO: Analyzing file: '/ var/log/messages.log'. 2009/06/11 20:44:20 ossec-logcollector: INFO: Started (pid: 81796). 2009/06/11 20:44:21 ossec-syscheckd: INFO: Started (pid: 81805). 2009/06/11 20:44:21 ossec-rootcheck: INFO: Started (pid: 81805). 2009/06/11 21:04:14 ossec-syscheckd: INFO: Starting syscheck scan (db). 2009/06/11 21:48:01 ossec-syscheckd: INFO: Ending syscheck scan (db). 2009/06/11 21:48:41 ossec-rootcheck: INFO: Starting rootcheck scan. Turning full debugging doesn't give me any more information. Rarely I get messages from agents, but this happends mostly at night time. During working day - no messages at all. I tried to start agents at different times with 2 hours difference and it didn't help either. What could this be? Any suggestions?
